HomeFreeBSD

if_ovpn: fix use-after-free

Description

if_ovpn: fix use-after-free

ovpn_encrypt_tx_cb() calls ovpn_encap() to transmit a packet, then adds
the length of the packet to the "tunnel_bytes_sent" counter. However,
after ovpn_encap() returns 0, the mbuf chain may have been freed, so the
load of m->m_pkthdr.len may be a use-after-free.

Reported by: markj
Sponsored by: Rubicon Communications, LLC ("Netgate")

Details

Provenance
kpAuthored on Oct 17 2022, 7:24 AM
Parents
rG865f46b25559: unbound: Reapply Vendor import 1.17.0
Branches
Unknown
Tags
Unknown